SlideShare a Scribd company logo
1 of 83
UMTS ...
… 3G Technology and Concepts
GSM/GPRS network architecture
GSM/GPRS core networkRadio access network
BSS
database
IP
Backbone
Internet
PSTN,ISDN
BTSBTS
BTSBTS
BSCBSC
MSCMSC
VLRVLR
SGSNSGSN
GMSCGMSC
HLRHLR
AuCAuC
EIREIR
GGSNGGSN
MSMS
PCUPCU
3GPP Rel.’99 network architecture
Core network (GSM/GPRS-
based)
Radio access network
UTRAN
UEUE
Iu CS
Iur
Iub
Uu
Gn
Iu PS
database
IP
Backbone
Internet
PSTN
BSBS
BSBS
RNCRNC
RNCRNC
MSCMSC
VLRVLR
SGSNSGSN
GMSCGMSC
HLRHLR
AuCAuC
EIREIR
GGSNGGSN
Iub
3GPP Rel.’99 network architecture
Radio access network
UTRAN
UEUE Iur
Iub
Uu
BSBS
BSBS
RNCRNC
RNCRNC
Iub
2G => 3G MS => UE
(User Equipment), often
also called (user) terminal
New air (radio) interface
based on WCDMA access
technology
New RAN architecture
(Iur interface is available
for soft handover,
BSC => RNC)
3GPP Rel.’99 network architecture
Core network (GSM/GPRS-
based)
Iu CS
Gn
Iu PS
IP
Backbone
Internet
PSTN
MSCMSC
VLRVLR
SGSNSGSN
GMSCGMSC
HLRHLR
AuCAuC
EIREIR
GGSNGGSN
Changes in the core
network:
MSC is upgraded to
3G MSC
SGSN is upgraded to
3G SGSN
GMSC and GGSN
remain the same
AuC is upgraded
(more security
features in 3G)
3GPP Rel.4 network architecture
Circuit Switched (CS)
core network
UTRAN
(UMTS Terrestrial
Radio Access
Network)
PSTN
MSC
Server
MSC
Server
New option in Rel.4:
GERAN
(GSM and EDGE
Radio Access
Network)
PS core as in Rel.’99
GMSC
Server
GMSC
Server
SGWSGW
MGWMGW
SGWSGW
MGWMGW
3GPP Rel.4 network architecture
Circuit Switched (CS)
core network
PSTN
MSC
Server
MSC
Server
PS core as in Rel.’99
GMSC
Server
GMSC
Server
SGWSGW
MGWMGW
SGWSGW
MGWMGW
MSC Server takes care
of call control signalling
The user connections
are set up via MGW
(Media GateWay)
“Lower layer” protocol
conversion in SGW
(Signalling GateWay)
RANAP / ISUPRANAP / ISUP
SS7
MTP
SS7
MTP
IP
Sigtran
IP
Sigtran
3GPP Rel.5 network architecture
CS core
PSTN
SGSNSGSN GGSNGGSN
MGWMGW
Internet
HSSHSS
IMS (IP
Multimedia
System)
IMS (IP
Multimedia
System)
PS core
UTRAN
(UMTS Terrestrial
Radio Access
Network)
GERAN
(GSM and EDGE
Radio Access
Network)
New core
network part:
3GPP Rel.5 network architecture
CS core
PSTN
SGSNSGSN GGSNGGSN
Internet/otherIMS
HSSHSS
PS core
The IMS can establish
multimedia sessions
(using IP transport)
via PS core between
UE and Internet (or
another IMS)
Call/session control
using SIP (Session
Initiating Protocol)
Interworking with the
PSTN may be required
for some time ...
IMS (IP
Multimedia
System)
IMS (IP
Multimedia
System)
MGWMGW
UMTS bearer service architecture
TE MT UTRAN CN Iu
edge node
TECN
gateway
End-to-end service
UMTS bearer service
Radio access bearer service CN b.s.
Local b.s. Ext. b.s.
Radio b.s. Iu b.s. Backbone
Radio Access BearerRadio Access BearerRadio BearerRadio Bearer
UE Core network
What is a bearer?
Bearer: a bearer capability of defined capacity, delay
and bit error rate, etc. (as defined in 3GPP specs.)
Bearer is a flexible concept designating some kind of
”bit pipe”
• at a certain network level (see previous slide)
• between certain network entities
• with certain QoS attributes, capacity, and traffic
flow characteristics
Four UMTS QoS Classes
• conversational, streaming, interactive, background
UMTS QoS (service) classes
ConversationalConversational StreamingStreaming InteractiveInteractive BackgroundBackground
low delay
low delay
variation
video
telephony/
conferencing
speech
video streaming
audio streaming
low round-trip
delay
www
applications
delay is not
critical
store-and-
forward
applications
(e-mail, SMS)
file transfer
reasonably low
delay
basic
applications
basic QoS requirements
Four UMTS QoS (service) classes
ConversationalConversational StreamingStreaming InteractiveInteractive BackgroundBackground
• speech (using AMR = Adaptive Multi-Rate speech coding)
• video telephony / conferencing:
ITU-T Rec. H.324 (over circuit switched connections)
ITU-T Rec. H.323 or IETF SIP (over packet switched
connections)
• low delay (< 400 ms) and low delay variation
• BER requirements not so stringent
• in the radio network => real-time (RT) connections
Adaptive Multi-Rate coding
kbit/s
12.2 (= GSM EFR)
10.2
7.95
7.40 (= US TDMA)
6.70 (= PDC EFR)
5.90
5.15
4.75
Adaptive
<=>
During the call,
the AMR bit rate
can be changed,
using the values
at the right
EFR = Enhanced
Full RateCodec negotiation
between transcoders
<=>
Transcoding
UEUE MSCMSC GMSCGMSC User BUser B
TCTC
Transcoder (AMR/PCM) should be located as far as
possible to the right (transmission capacity savings)
TCTC
Transcoding should be avoided altogether (better signal
quality)
TFO = Tandem Free Operation (2G)
TrFO = Transcoder Free Operation (3G)
(possible only if same coding is used at both
ends of connection)
(e.g. in PSTN)
Four UMTS QoS (service) classes
ConversationalConversational StreamingStreaming InteractiveInteractive BackgroundBackground
• video streaming
• audio streaming
• reasonably low delay and delay variation
• BER requirements quite stringent
• traffic management important (variable bit rate)
• in the radio network => real-time (RT) connections
UEUE SourceSource
video or audio information is buffered in the UE,
large delay => buffer is running out of content!
Buffer
Four UMTS QoS (service) classes
ConversationalConversational StreamingStreaming InteractiveInteractive BackgroundBackground
• web browsing
• interactive games
• location-based services (LCS)
• low round-trip delay (< seconds)
• delay variation is not important
• BER requirements stringent
• in the radio network => non-real-time (NRT) connections
Four UMTS QoS (service) classes
ConversationalConversational StreamingStreaming InteractiveInteractive BackgroundBackground
• SMS (Short Message Service) and other more advanced
messaging services (EMS, MMS)
• e-mail notification, e-mail download
• file transfer
• delay / delay variation is not an important issue
• BER requirements stringent
• in the radio network => non-real-time (NRT) connections
UMTS protocols
Different protocol stacks for user and control plane
User plane (for transport of user data):
Circuit switched domain: data within ”bit pipes”
Packet switched domain: protocols for implementing
various QoS or traffic engineering mechanisms
Control plane (for signalling):
Circuit switched domain: SS7 based (in core network)
Packet switched domain: IP based (in core network)
Radio access network: UTRAN protocols
Data streamsData streams
RLCRLC
MACMAC
Phys.Phys.
UE UTRAN 3G MSC GMSC
Uu Iu Gn
User plane protocol stacks (CS domain)
RLCRLC
MACMAC
Phys.Phys.
WCDMAWCDMA
TDMTDM
Frame Protocol (FP)Frame Protocol (FP)
AAL2AAL2
ATMATM
Phys.Phys.
AAL2AAL2
ATMATM
Phys.Phys.
TDMTDM
User plane protocol stacks (PS domain)
PDCPPDCP
RLCRLC
GTPGTP
UDPUDP
IPIP
GTPGTP
UDPUDP
IPIP
IPIP IPIP
GTPGTP
UDPUDP
PDCPPDCP
RLCRLC
MACMAC
Phys.Phys.
MACMAC
Phys.Phys.
AAL5AAL5
ATMATM
Phys.Phys.
AAL5AAL5
ATMATM
Phys.Phys.
IPIP
L2L2
L1L1
GTPGTP
UDPUDP
IPIP
L2L2
L1L1
UE UTRAN SGSN GGSN
Uu Iu Gn
WCDMAWCDMA
Uu (air, radio) interface protocols
PHYPHY
MACMAC
RLCRLC
RRCRRC
Signalling
radio bearers
(User plane)
radio bearers
e.g. MM, CC, SM
transparent to UTRAN
Logical channels
Transport channels
PDCPPDCP
L3
L2
L1
Main tasks of Uu interface protocols
MAC (Medium Access Control):
• Mapping between logical and transport channels
• Segmentation of data into transport blocks
RLC (Radio Link Control):
• Segmentation and reassembly
• Link control (flow & error control)
• RLC is often a transparent layer
PDCP (Packet Data Convergence Protocol):
• IP packet header compression (user plane only)
Main tasks of RRC protocol
Over the air interface, Radio Resource Control (RRC)
messages carry all the relevant information required for
setting up a Signalling Radio Bearer (during the lifetime
of the RRC Connection) and setting up, modifying, and
releasing Radio Bearers between UE and UTRAN (all
being part of the RRC Connection).
RRC also participates in the co-ordination of other Radio
Resource Management (RRM) operations, such as
measurements and handovers.
In addition, RRC messages may carry in their payload
higher layer signalling information (MM, CC or SM) that
is not related to the air interface or UTRAN.
General protocol model for UTRAN
Radio
Network
Layer
Transport
Network
Layer
Control Plane User Plane
Transport Netw.
Control Plane
Application
Protocol
Application
Protocol
Data
Stream(s)
Data
Stream(s)
Signalling
Bearer(s)
Signalling
Bearer(s)
ProtocolProtocol
Data
Bearer(s)
Data
Bearer(s)
Transport Netw.
User Plane
Transport Netw.
User Plane
Signalling
Bearer(s)
Signalling
Bearer(s)
Physical LayerPhysical Layer
Control Plane (Iub, Iur and Iu interfaces)
Radio Network Layer: application protocols (NBAP,
RNSAP and RANAP) are used for the actual signalling
between base stations, RNC and core network.
Transport Network Layer: signalling bearer for the
transport of application protocol messages is set up by
O&M actions (i.e. on a permanent basis).
Transport Network Control Plane
A signalling bearer (set up by O&M actions) carries a
protocol which is used only for the task of setting up
data bearers (e.g. AAL 2 connections).
User Plane (Iub, Iur and Iu interfaces)
The User Plane is employed for transport of
• user information (speech, video, IP packets ...)
• RRC signalling messages (Iub, Iur)
• higher-layer protocol information at Iu interface
(if not carried by RANAP).
User plane data is carried by data bearers which use
AAL 5 in case of Iu PS and AAL 2 in all other cases.
User data streams are packed in frame protocols (FP)
which are used for framing, error & flow control, and
carrying of parallel data flows that form the user data
signal (e.g. AMR encoded speech).
Protocol structure at Iub interface
Radio
Network
Layer
Transport
Network
Layer
Control Plane
Transport Netw.
Control Plane
NBAPNBAP
Transport Netw.
User Plane
Transport Netw.
User Plane
Q.2630.1Q.2630.1
Convergence
Protocols
Convergence
Protocols
AAL 5AAL 5
Conv. Pr.Conv. Pr.
AAL 5AAL 5 AAL 2AAL 2
ATMATM
Physical LayerPhysical Layer
RRCRRC DataData
RLCRLC
MACMAC
Frame ProtocolFrame Protocol
Control Plane
Transport Netw.
Control Plane
RNSAPRNSAP
Transport Netw.
User Plane
Transport Netw.
User Plane
Q.2630.1Q.2630.1
Convergence
Protocols
Convergence
Protocols
AAL 5AAL 5
Conv. Pr.Conv. Pr.
AAL 5AAL 5 AAL 2AAL 2
ATMATM
Physical LayerPhysical Layer
Protocol structure at Iur interface
Radio
Network
Layer
Transport
Network
Layer
RRCRRC DataData
RLCRLC
MACMAC
Frame ProtocolFrame Protocol
Radio
Network
Layer
Transport
Network
Layer
Control Plane User Plane
Transport Netw.
Control Plane
RANAPRANAP
Transport Netw.
User Plane
Transport Netw.
User Plane
Q.2630.1Q.2630.1
Convergence
Protocols
Convergence
Protocols
AAL 5AAL 5
Conv. Pr.Conv. Pr.
AAL 5AAL 5
CS ChannelCS Channel
Iu UPIu UP
AAL 2AAL 2
ATMATM
Physical LayerPhysical Layer
Protocol structure at Iu CS interface
Radio
Network
Layer
Transport
Network
Layer
Control Plane User Plane
Transport Netw.
Control Plane
RANAPRANAP
Transport Netw.
User Plane
Convergence
Protocols
Convergence
Protocols
AAL 5AAL 5
IP ApplicationIP Application
Protocol structure at Iu PS interface
GTPGTP
UDPUDP
IPIP
AAL 5AAL 5
ATMATM
Physical LayerPhysical Layer
Iu UPIu UP
Application protocols in UTRAN
Iub interface (between RNC and base station)
NBAP (Node B Application Part)
Iur interface (between Serving RNC and Drift RNC)
RNSAP (Radio Network Subsystem Application Part)
- Link management for inter-RNC soft handover
Iu interface (between RNC and core network)
RANAP (Radio Access Network Application Part)
- Radio Access Bearer (RAB) management
- SRNS Relocation
- Transfer of higher-level signalling messages
Serving RNC and Drift RNC in UTRAN
Core
network
Iu
Iur
Iub
Iub
DRNC
SRNC
UEUE
BSBS
BSBS
RNCRNC
RNCRNC
Concept needed for:
Soft handover between base stations belonging to different RNCs
Serving RNS (SRNS) Relocation
RNS = Radio Network Sub-system =
RNC + all base stations controlled by this RNC
SRNS Relocation means that the Serving RNC
functionality is transferred from one RNC (the “old”
SRNC) to another (the “new” SRNC, previously a
DRNC) without changing the radio resources and
without interrupting the user data flow.
RANAP provides the signalling facilities over the
two Iu interfaces involved (Iu interfaces to “old”
and “new” SNRC) for performing SRNC Relocation
in a co-ordinated manner.
SRNS Relocation (cont.)
Core
network
Iu
Iur
Iub
Iub
DRNC
SRNC
UEUE
BSBS
BSBS
RNCRNC
RNCRNC Iu
SRNC
SRNC provides: 1) connection to core network
2) macrodiversity combining point
Soft handover concept
Iu
Iur
Iub
Iub
DRNC
SRNC
UEUE
BSBS
BSBS
RNCRNC
RNCRNC
Leg 1
Leg 3
Signal
combining
point is in
SRNC
(downlink:
in UE)
BSBS Leg 2
Legs 1 and 2: Iur interface is not needed
Leg 3 is added: Iur interface is needed!
Core
network
Micro- / macrodiversity combining
Iu
Iur
Iub
Iub
DRNC
SRNC
UEUE
BSBS
BSBS
RNCRNC
RNCRNC
Macrodiversity
combining point
in SRNC
Core
network
Rake
receiver
Multipath
propagation
Microdiversity combining point in base station
(uplink)
Micro- / macrodiversity combining
Microdiversity combining: multipath signal
components are processed in Rake “fingers” and
combined (= summed) using MRC
(MRC = Maximum Ratio Combining)
Macrodiversity combining: the same bit sequences
(with different bit error positions) are combined at
the SRNC (usually: selection combining).
Hard handover: slow (a lot of signalling)
Soft handover: fast selection in SRNC
(uplink)
Radio Access Bearer (RAB) establishment
RAB assignment request
RAB assignment complete
RAB is configured to be used
over existing Radio Link(s)
(RANAP signaling)
UE BS RNC
(RRC signaling)
Core network
Signalling between UE and core network
UEUE BSBS RNCRNC MSC or
SGSN
MSC or
SGSN
RRC RANAP
NAS signalling messages (NAS = Non Access Stratum =
“not related to UTRAN”) are sent transparently through
UTRAN in the payload of RRC/RANAP protocol messages
Security in UMTS
GSM UMTS
SIM authentication
(PIN code)
SIM authentication
(PIN code)
User authenticationUser authentication
Ciphering (air interface)Ciphering (air interface)
Signalling data integritySignalling data integrity
IP security (e.g. IPSEC)IP security (e.g. IPSEC)
User authenticationUser authentication
Network authenticationNetwork authentication
USIM authentication
(PIN code)
USIM authentication
(PIN code)
Ciphering (air interface)Ciphering (air interface)
KASUMI algorithm (known)
UMTS: larger key lengths
than in GSM
Security in digital networks: terminology
Authentication:
SIM authentication (PIN code)
user authentication (GSM, UMTS, DECT, TETRA)
network authentication (UMTS, TETRA)
Integrity:
signalling data integrity (UMTS)
Confidentiality (≈ privacy):
ciphering of signals over radio interface
hiding of user identifiers over radio interface
end-to-end encryption (offered by service provider)
Authentication
Authentication: Procedure of verifying the authenticity
of an entity (user, terminal, network, network element).
In other words, is the entity the one it claims to be?
SIM authentication is local (network is not involved)
In GSM, only user is authenticated
In UMTS, both user and network are authenticated
User/network is authenticated at the beginning of
each user-network transaction (e.g. location updating
or connection set-up) and always before ciphering
starts.
See Security in GSM
for more details
Integrity
Data integrity: The property that data has not been
altered in an unauthorised manner.
“Man-in-the-middle” security attack, e.g. false BS
Data integrity checking is not done in GSM
In UMTS, signalling messages are appended with a
32 bit security field (MAC-I) at the terminal or RNC
before transmission and checked at the receiving end
In UMTS, also volume of user data (not the user data
itself) is integrity protected
Signalling integrity protection in UMTS
Signalling messageSignalling message
Algorithm f 9
MAC-IMAC-I
Integrity Key (IK)
and other
keys/parameters
UEUE RNCRNC
MAC-I generation MAC-I checking
MAC-I generationMAC-I checking
Both in
terminal
and RNC
Confidentiality
Confidentiality: The property that information is not
made available to unauthorised individuals, entities or
processes.
Example 1: Ciphering (encryption) over the air interface
Example 2: Preventing unencrypted transmission of
user ID information such as IMSI number over the air
interface
=> Temporary Mobile Subscriber Identity (TMSI) is
generated (at the end of each MM or CM transaction)
and is used at the beginning of the next transaction
instead of IMSI.
Example 1: ciphering (encryption)
BSBS
MSMS
UEUE
BTSBTS BSCBSC
RNCRNC
SGSNSGSN
Core NetworkCore Network
Air interface
GPRS
UMTS
MSMS BTSBTS BSCBSC Core NetworkCore Network
GSM
Both CS and PS information
Signalling integrity protection
Network domain security
Circuit switched network => quite good
IP-based network (Internet) => rather poor at present
(security mechanisms are developed by IETF, 3GPP...)
Some security threats in IP-based network:
Sniffing (electronic eavesdropping)
Spoofing, session hijacking
Denial of service (DoS), ”spamming”
Confidentiality
Integrity
WCDMA Technology
… just some basic issues
RLCRLC RLCRLC
Logical / Transport / Physical channels
MACMAC
FPFP
PhyPhy FPFP
UE Base station RNC
AAL 2AAL 2
MACMAC
AAL 2AAL 2
PhyPhy
Logical channels
Physical channels
Transport channels
: :
WCDMA
::
Logical / Transport channels
CCCHCCCH DCCHDCCH
PCHPCH DCHDCHDSCHDSCHFACHFACHBCHBCHDCHDCHCPCHCPCHRACHRACH
DCCHDCCHCTCHCTCHCCCHCCCHBCCHBCCHPCCHPCCH
Uplink Downlink
DTCHDTCH DTCHDTCH
Logical channels
Transport channels
Transport / Physical channels
PCHPCH DCHDCHDSCHDSCHFACHFACH BCHBCH
DCHDCH
CPCHCPCHRACHRACH
PRACHPRACH PCPCHPCPCH SCCPCHSCCPCH PCCPCHPCCPCH DPDCHDPDCH
DPCCHDPCCH
SCHSCHCPICHCPICH
AICHAICH
PICHPICH
CSICHCSICH
Physical channels
Transport channels
DPCHDPCH
CD/CA-
ICH
CD/CA-
ICH
Uplink Downlink
PDSCHPDSCH
Physical channels in WCDMA
Bit sequences from different physical channels are
multiplied with a channelization code (spreading)
multiplied with a scrambling code (scrambling)
multiplexed in code domain
modulated using QPSK.
Downlink channels: conventional QPSK modulation
DPCH = Dedicated physical channel
Uplink channels: Dual-channel QPSK moduation
DPDCH = Dedicated physical data
channel
DPCCH = Dedicated physical control channel
DPCH structure in downlink
TFCITFCI DataData TPCTPC DataData
10 ms radio frame
0 1 2 14
2560 chips
PilotPilot
QPSK modulation,
time multiplexed data and control information:
(DPCH = Dedicated Physical Channel)
DPDCH / DPCCH structure in uplink
(Dedicated Physical Data/Control Channel)
DataData
PilotPilot TFCITFCI FBIFBI TPCTPC
DPDCH (I-branch)DPDCH (I-branch)
10 ms radio frame (38400 chips)
0 1 2 14
2560 chips
DPCCH (Q-branch)DPCCH (Q-branch)
Dual-channel QPSK modulation:
Spreading in WCDMA
Channel
data
Channel
data
Channelization
code
Channelization
code
Scrambling
code
Scrambling
code
Channel
bit rate
Chip rate Chip rate
Usage of codeUsage of code UplinkUplink DownlinkDownlink
Channelization code
Scrambling code
User separation
User separation Cell separation
(always 3.84 million chips/s)
Spreading in WCDMA
Chip rate = SF x channel bit rateChip rate = SF x channel bit rate
Chip rate after spreading = 3.84 Mchips/sChip rate after spreading = 3.84 Mchips/s
Uplink: DPCCH SF = 256, DPDCH SF = 4 - 256Uplink: DPCCH SF = 256, DPDCH SF = 4 - 256
Downlink: DPCH SF = 4 - 256 (512)Downlink: DPCH SF = 4 - 256 (512)
Spreading factor (SF) is important in WCDMA
One bit consists
of 256 chips
One bit consists
of 4 chips
Uplink DPDCH bit rates
256
128
64
32
16
8
4
SF Channel bit rate
(kb/s)
User data rate
(kb/s)
15
30
60
120
240
480
approx. 7.5
approx. 15
approx. 30
approx. 60
approx. 120
approx. 240
960 approx. 480
Downlink DPDCH bit rates
256
128
64
32
16
8
4
SF Channel bit rate
(kb/s)
User data rate
(kb/s)
15
30
60
120
240
480
approx. 1-3
approx. 6-12
approx. 20-24
approx. 45
approx. 105
approx. 215
960 approx. 456
512
1920 approx. 936
User data rate vs. channel bit rate
Channel bit rate (kb/s)Channel bit rate (kb/s)
User data rate (kb/s)User data rate (kb/s)
Channel codingChannel coding
InterleavingInterleaving
Bit rate matchingBit rate matching
Interesting
for user
Interesting
for user
Important
for system
Important
for system
Services for 3G (and partly 2G)
• terminology
• basic concepts
New service concept
End userEnd user End userEnd user
Carrier providerCarrier provider
Service providerService provider Service providerService provider
Content providerContent provider Content providerContent provider
all want to
make profit
OSA is being standardised, so that services provided
by different service/content providers can be created
and seamlessly integrated into the 3G network (this is
the meaning of “open” architecture)
OSA (Open Services Architecture/Access)
3G network
API API API
Service Creation Environment (SCE)
API =
Application
Programming
Interface
(Standardised)
OSA means in practice:
CAMEL (Customised Applications for Mobile network
Enhanced Logic) is a set of “IN” type functions and
procedures that make operator-specific IN services
available to subscribers who roam outside their home
network.
CAMEL = IN technology + global mobility
CAMEL Service Environment (CSE) is a logical entity in
the subscriber’s home network which processes IN
related procedures
CSE ≈ SCP in home network
CAMEL (2G & 3G)
Circuit switched call-related IN procedures
CAMEL Phase 1
1. Call control proceeds up to MSC
SSPSSP
MSCMSC
SCP in home
network (CSE)
SCP in home
network (CSE)
1.
2.
3.
4.
5.
2. Trigger activated in basic call state model at SSP
3. SSP requests information from CSE
4. CSE provides information
5. Call control continues
Typical
triggers:
Calling number
Called number
Cell ID
Protocol: CAP instead of MAP
CAMEL Phase 2
Non-call-related procedures possible
1. Call control proceeds as normal
2. Call control is interrupted
3. Call control resumes
Typical
application:
In prepaid service:
announcement
”your prepaid
account is
approaching zero”
(e.g. for announcement)
IN functionality is extended to include packet switched
sessions...
CAMEL Phase 3
Virtual Home Environment (VHE)
Same subscriber profile & charging/numbering information
can be utilised in any UMTS network
Home PLMN Visited PLMN
UEUE
Certain subscriber
profile
Same subscriber
profile
Supporting technologies and services
PositioningPositioning
SMSSMS
USSDUSSD
MMSMMSLCSLCS
SATSAT USATUSAT
MExEMExE
WAPWAP
Location
UE
Transport
&
Contenti-Modei-Mode
- many are already possible in 2G
- will (perhaps) be extensively used in 3G
Location (based) services (LCS)
- may or may not use UE positioning techniques
- general LCS architecture in UMTS:
UEUE
PSTN
Internet
BSBS
LMULMU
RNC &
SMLC
RNC &
SMLC
MSCMSC
GMLCGMLC
SGSNSGSN GGSNGGSN
HLR/AuC/EIRHLR/AuC/EIR
GMSCGMSC
LCS External
Client
Location (based) services (cont.)
GMLC = Gateway Mobile Location Center
receives service requests from external LCS clients
(or UE) and manages the location information
SMLC = Serving Mobile Location Center
assists in positioning of the UE (e.g. performs
calculations based on measurement results), is
usually integrated with RNC
LCS client = typically any server requesting location
information (to be able to provide the relevant
location service to the user), may also be the UE
Positioning methods
BSBS
BSBS
BSBS
UEUE LMULMU
Cell ID based location information
- no expensive positioning solutions required
- inexpensive (and will
therefore be widely used)
E-OTD (2G), OTDOA (3G)
- differential delays measured
from which the position
is calculated (in SMLC)
Assisted GPS
- greatest precision, GPS receiver in UE
- network must “assist” in indoor environment
SMLCSMLC
SAT (= USAT in 3G)
SAT (SIM Application Toolkit) is a set of standardized
functions for communication between SIM and ME
SIM
ME
Applications (GSM 11.14):
• profile download (ME tells SIM what it can do)
• proactive SIM (display text from SIM to ME, send
short message, transfer info from ME to SIM,...)
• call control by SIM
• data download from network to SIM
Download (e.g. Java applets) from server in
network will be important in UMTS
Interaction between ME and SIM
MExE
Mobile Execution Environment (MExE) provides
standardized application execution environments for
UE, defined in classmarks:
MExE Classmark 1
MExE Classmark 2
MExE Classmark 3
UE is WAP compatible (i.e. contains
WAP browser)
UE can execute PersonalJava
applications (subset of J2SE)
UE is J2ME compatible Standard
Edition
Micro Edition:
see: www.mexeforum.org Evolution continues ...
SMS vs. USSD
SMS = Short Message Service
USSD = Unstructured Supplementary Services Data
SMS
• 160 ASCII characters (max)
• in all GSM terminals
• store-and-forward service
(=> delay)
• transport of messages
• SMS transaction always
initiated by terminal
USSD
• 182 ASCII characters (max)
• in all GSM terminals
• connection oriented
transactions (small delay)
• transport of technical data
• terminal or application in
network initiates session
very popular not much used (yet)
MMS
MMS = Multimedia Messaging System
Offers the possibility to send messages to/from MMS
capable handsets comprising a combination of
- text
- sounds
- images
- video
GPRS or 3G packet domain can be used for transport.
When combined with LCS information and IN (CAMEL)
features, interesting new services can be implemented.
WAP (Wireless Application Protocol)
Transports WML (Wireless Markup Language)
information between terminal and WAP Gateway (using
its own set of protocols)
WAP
Gateway
WAP
Gateway
UEUE 2G/3G
networ
k
Internet
Server
Internet
Server
WAP
browser WML / HTML
translation
WMLWML
WAP protocolsWAP protocols
2G/3G transport2G/3G transport
WML is a subset of XML
e.g. WTP (similar functionality as HTTP)
SMS, USSD, GPRS, 3G packet transport ...
WML /
HTML / XML
content
Service interaction example
3G subscriber is hungry and asks for a list of nearby
located restaurants (from appropriate “Internet Server”).
Network scenario:
UEUE
2G/3G
networ
k
WAP
Gateway
WAP
Gateway
Internet
Server
Internet
Server
CAMEL
(CSE)
CAMEL
(CSE)
GMLCGMLC MExEMExE
See:
Kaaranen et al:
UMTS Networks
Example, Step 1
By use of his/her WAP browser in the UE, user contacts
(via WAP Gateway) the “Internet Server” containing
relevant information.
UEUE
2G/3G
networ
k
WAP
Gateway
WAP
Gateway
Internet
Server
Internet
Server
CAMEL
(CSE)
CAMEL
(CSE)
GMLCGMLC MExEMExE
WAP
browser
Example, Step 2
The 2G/3G network retrieves subscription information
(e.g. state of “prepaid” account) from the user’s CSE
(Camel Service Environment).
Charging
info
UEUE
2G/3G
networ
k
WAP
Gateway
WAP
Gateway
Internet
Server
Internet
Server
CAMEL
(CSE)
CAMEL
(CSE)
GMLCGMLC MExEMExE
Example, Step 3
“Internet Server” acts as a “LCS client” and requests the
2G/3G network to investigate where the user is located.
UEUE
2G/3G
networ
k
WAP
Gateway
WAP
Gateway
Internet
Server
Internet
Server
CAMEL
(CSE)
CAMEL
(CSE)
GMLCGMLC MExEMExE
Where is UE located?
Example, Step 4
The “MExE compatible Internet Server” prepares the
information according to the MExE capabilities of UE
(in this case MExE Classmark 1: WAP).
What can UE
display?
UEUE
2G/3G
networ
k
WAP
Gateway
WAP
Gateway
Internet
Server
Internet
Server
CAMEL
(CSE)
CAMEL
(CSE)
GMLCGMLC MExEMExE
?
?
Example, Step 5
Now the “local restaurants” information is downloaded to
the user and displayed in the appropriate form.
Restaurant 1
Restaurant 2
Restaurant 3
Restaurant 4
Menu on display:
UEUE
2G/3G
networ
k
WAP
Gateway
WAP
Gateway
Internet
Server
Internet
Server
CAMEL
(CSE)
CAMEL
(CSE)
GMLCGMLC MExEMExE
Further information on 3G systems and
services
Links: see slides
Books:
Kaaranen et al., UMTS Networks: Architecture, Mobility and
Services, Wiley, 2001, ISBN 0-471-48654-X
Korhonen, Introduction to 3G Mobile Communications, Artech
House, 2001, ISBN 1-58053-287-X
Web material:
e-learning course “Introduction to 3G” contains audio and
flash animations (you need loudspeakers; access to course
only within the HUT computer network)
http://130.233.158.46/eopetus/intro3g/start.htm
Required course material

More Related Content

What's hot

Mobile Networks Overview (2G / 3G / 4G-LTE)
Mobile Networks Overview (2G / 3G / 4G-LTE)Mobile Networks Overview (2G / 3G / 4G-LTE)
Mobile Networks Overview (2G / 3G / 4G-LTE)Hamidreza Bolhasani
 
UMTS system architecture, protocols & processes
UMTS system architecture, protocols & processesUMTS system architecture, protocols & processes
UMTS system architecture, protocols & processesMuxi ESL
 
Umts explained
Umts explainedUmts explained
Umts explainedassinha
 
Mobility Management
Mobility ManagementMobility Management
Mobility ManagementHira Shaukat
 
GSM Architecture
GSM ArchitectureGSM Architecture
GSM Architecturekoonlay
 
2G / 3G / 4G / IMS / 5G Overview with Focus on Core Network
2G / 3G / 4G / IMS / 5G Overview with Focus on Core Network2G / 3G / 4G / IMS / 5G Overview with Focus on Core Network
2G / 3G / 4G / IMS / 5G Overview with Focus on Core NetworkHamidreza Bolhasani
 
Gsm architecture, gsm network identities, network cases, cell planning, and c...
Gsm architecture, gsm network identities, network cases, cell planning, and c...Gsm architecture, gsm network identities, network cases, cell planning, and c...
Gsm architecture, gsm network identities, network cases, cell planning, and c...Zorays Solar Pakistan
 
4 g LTE, LTE Advance
4 g LTE, LTE Advance 4 g LTE, LTE Advance
4 g LTE, LTE Advance Sajid Marwat
 
02 umts network architecturenew
02 umts network architecturenew02 umts network architecturenew
02 umts network architecturenewsivakumar D
 
GSM(Global System For Mobile) Communication
GSM(Global System For Mobile) CommunicationGSM(Global System For Mobile) Communication
GSM(Global System For Mobile) CommunicationNavin Kumar
 
Nemo outdoor 6_training_aug2011 [compatibility mode]
Nemo outdoor 6_training_aug2011 [compatibility mode]Nemo outdoor 6_training_aug2011 [compatibility mode]
Nemo outdoor 6_training_aug2011 [compatibility mode]Doduor
 
LTE Architecture and interfaces
LTE Architecture and interfacesLTE Architecture and interfaces
LTE Architecture and interfacesAbdulrahman Fady
 

What's hot (20)

GPRS
GPRSGPRS
GPRS
 
Mobile Networks Overview (2G / 3G / 4G-LTE)
Mobile Networks Overview (2G / 3G / 4G-LTE)Mobile Networks Overview (2G / 3G / 4G-LTE)
Mobile Networks Overview (2G / 3G / 4G-LTE)
 
UMTS system architecture, protocols & processes
UMTS system architecture, protocols & processesUMTS system architecture, protocols & processes
UMTS system architecture, protocols & processes
 
Umts explained
Umts explainedUmts explained
Umts explained
 
3G System
3G System3G System
3G System
 
Basic of teleom gsm
Basic of teleom gsmBasic of teleom gsm
Basic of teleom gsm
 
Mobility Management
Mobility ManagementMobility Management
Mobility Management
 
GSM Architecture
GSM ArchitectureGSM Architecture
GSM Architecture
 
2G / 3G / 4G / IMS / 5G Overview with Focus on Core Network
2G / 3G / 4G / IMS / 5G Overview with Focus on Core Network2G / 3G / 4G / IMS / 5G Overview with Focus on Core Network
2G / 3G / 4G / IMS / 5G Overview with Focus on Core Network
 
Gsm architecture, gsm network identities, network cases, cell planning, and c...
Gsm architecture, gsm network identities, network cases, cell planning, and c...Gsm architecture, gsm network identities, network cases, cell planning, and c...
Gsm architecture, gsm network identities, network cases, cell planning, and c...
 
Umts(3g)
Umts(3g)Umts(3g)
Umts(3g)
 
4 g LTE, LTE Advance
4 g LTE, LTE Advance 4 g LTE, LTE Advance
4 g LTE, LTE Advance
 
LTE Basic
LTE BasicLTE Basic
LTE Basic
 
Gsm architecture
Gsm architecture Gsm architecture
Gsm architecture
 
GSM
GSMGSM
GSM
 
02 umts network architecturenew
02 umts network architecturenew02 umts network architecturenew
02 umts network architecturenew
 
GSM(Global System For Mobile) Communication
GSM(Global System For Mobile) CommunicationGSM(Global System For Mobile) Communication
GSM(Global System For Mobile) Communication
 
Nemo outdoor 6_training_aug2011 [compatibility mode]
Nemo outdoor 6_training_aug2011 [compatibility mode]Nemo outdoor 6_training_aug2011 [compatibility mode]
Nemo outdoor 6_training_aug2011 [compatibility mode]
 
LTE Architecture and interfaces
LTE Architecture and interfacesLTE Architecture and interfaces
LTE Architecture and interfaces
 
GSM ARCHITECTURE
GSM ARCHITECTUREGSM ARCHITECTURE
GSM ARCHITECTURE
 

Viewers also liked

Small cell Evolution final
Small cell Evolution finalSmall cell Evolution final
Small cell Evolution finalXian Sun-Ilmonen
 
3G and LTE Enterprise Small Cell Architecture 2016
3G and LTE Enterprise Small Cell Architecture 20163G and LTE Enterprise Small Cell Architecture 2016
3G and LTE Enterprise Small Cell Architecture 2016David Chambers
 
Synchronization Architecture for 3G and 4G Networks
Synchronization Architecture for 3G and 4G NetworksSynchronization Architecture for 3G and 4G Networks
Synchronization Architecture for 3G and 4G NetworksSymmetricomSYMM
 
IP Mobile Backhaul Presentation
IP Mobile Backhaul PresentationIP Mobile Backhaul Presentation
IP Mobile Backhaul PresentationAviat Networks
 
Basic of 3 g technologies (digi lab_project).pptx [repaired]
Basic of 3 g technologies (digi lab_project).pptx [repaired]Basic of 3 g technologies (digi lab_project).pptx [repaired]
Basic of 3 g technologies (digi lab_project).pptx [repaired]Shahrin Ahammad
 
Cellular Architecture Design Concepts
Cellular Architecture Design ConceptsCellular Architecture Design Concepts
Cellular Architecture Design ConceptsT. L. Singal
 
5 g –wireless technology
5 g –wireless technology5 g –wireless technology
5 g –wireless technologySushil Sudake
 
Wireless communication and cellular concept
Wireless communication and cellular conceptWireless communication and cellular concept
Wireless communication and cellular conceptsaam123
 
Comparison between 2g, 2.5g, 3g, lte and lte a
Comparison between 2g, 2.5g, 3g, lte and lte aComparison between 2g, 2.5g, 3g, lte and lte a
Comparison between 2g, 2.5g, 3g, lte and lte aManish Srivastava
 
Mobile Network Infrastructure Sharing - Industry Overview & Coleago's Approach
Mobile Network Infrastructure Sharing - Industry Overview & Coleago's ApproachMobile Network Infrastructure Sharing - Industry Overview & Coleago's Approach
Mobile Network Infrastructure Sharing - Industry Overview & Coleago's ApproachColeago Consulting
 
Generation of mobile communication systems
Generation of mobile communication systemsGeneration of mobile communication systems
Generation of mobile communication systemsjincy-a
 

Viewers also liked (20)

Small cell Evolution final
Small cell Evolution finalSmall cell Evolution final
Small cell Evolution final
 
3G and LTE Enterprise Small Cell Architecture 2016
3G and LTE Enterprise Small Cell Architecture 20163G and LTE Enterprise Small Cell Architecture 2016
3G and LTE Enterprise Small Cell Architecture 2016
 
Synchronization Architecture for 3G and 4G Networks
Synchronization Architecture for 3G and 4G NetworksSynchronization Architecture for 3G and 4G Networks
Synchronization Architecture for 3G and 4G Networks
 
IP Mobile Backhaul Presentation
IP Mobile Backhaul PresentationIP Mobile Backhaul Presentation
IP Mobile Backhaul Presentation
 
Ip ran v1.1
Ip ran v1.1Ip ran v1.1
Ip ran v1.1
 
IP RAN 100NGN
IP RAN 100NGNIP RAN 100NGN
IP RAN 100NGN
 
Basic of 3 g technologies (digi lab_project).pptx [repaired]
Basic of 3 g technologies (digi lab_project).pptx [repaired]Basic of 3 g technologies (digi lab_project).pptx [repaired]
Basic of 3 g technologies (digi lab_project).pptx [repaired]
 
Cellular Architecture Design Concepts
Cellular Architecture Design ConceptsCellular Architecture Design Concepts
Cellular Architecture Design Concepts
 
3G IP Architecture
3G IP Architecture3G IP Architecture
3G IP Architecture
 
Fundamentals of Mobile Network Sharing
Fundamentals of Mobile Network SharingFundamentals of Mobile Network Sharing
Fundamentals of Mobile Network Sharing
 
LTE Basics - II
LTE Basics - IILTE Basics - II
LTE Basics - II
 
Introduction to LTE
Introduction to LTEIntroduction to LTE
Introduction to LTE
 
5 g –wireless technology
5 g –wireless technology5 g –wireless technology
5 g –wireless technology
 
Wireless communication and cellular concept
Wireless communication and cellular conceptWireless communication and cellular concept
Wireless communication and cellular concept
 
Comparison between 2g, 2.5g, 3g, lte and lte a
Comparison between 2g, 2.5g, 3g, lte and lte aComparison between 2g, 2.5g, 3g, lte and lte a
Comparison between 2g, 2.5g, 3g, lte and lte a
 
2G & 3G Overview
2G & 3G Overview2G & 3G Overview
2G & 3G Overview
 
1G,2G,3G,4G technologies
1G,2G,3G,4G technologies1G,2G,3G,4G technologies
1G,2G,3G,4G technologies
 
Mobile Network Infrastructure Sharing - Industry Overview & Coleago's Approach
Mobile Network Infrastructure Sharing - Industry Overview & Coleago's ApproachMobile Network Infrastructure Sharing - Industry Overview & Coleago's Approach
Mobile Network Infrastructure Sharing - Industry Overview & Coleago's Approach
 
Generation of mobile communication systems
Generation of mobile communication systemsGeneration of mobile communication systems
Generation of mobile communication systems
 
LTE Basics
LTE BasicsLTE Basics
LTE Basics
 

Similar to UMTS OVERVIEW

Similar to UMTS OVERVIEW (20)

6044847.ppt
6044847.ppt6044847.ppt
6044847.ppt
 
Lecture 10
Lecture 10Lecture 10
Lecture 10
 
Lte overview titus
Lte overview titusLte overview titus
Lte overview titus
 
Digital network lecturer6
Digital network  lecturer6Digital network  lecturer6
Digital network lecturer6
 
gsm.pdf
gsm.pdfgsm.pdf
gsm.pdf
 
Maria D'cruz_WCDMA UMTS Wireless Networks
Maria D'cruz_WCDMA UMTS Wireless NetworksMaria D'cruz_WCDMA UMTS Wireless Networks
Maria D'cruz_WCDMA UMTS Wireless Networks
 
14 wcdma
14 wcdma14 wcdma
14 wcdma
 
Wireless networking
Wireless networkingWireless networking
Wireless networking
 
Wcdma umts wireless networks
Wcdma umts wireless networksWcdma umts wireless networks
Wcdma umts wireless networks
 
3 g to 4g transformation
3 g to 4g transformation3 g to 4g transformation
3 g to 4g transformation
 
LTE network: How it all comes together architecture technical poster
LTE network: How it all comes together architecture technical posterLTE network: How it all comes together architecture technical poster
LTE network: How it all comes together architecture technical poster
 
Fullgsm overviewmodified-111004024904-phpapp01
Fullgsm overviewmodified-111004024904-phpapp01Fullgsm overviewmodified-111004024904-phpapp01
Fullgsm overviewmodified-111004024904-phpapp01
 
Wireless Metropolitan Area Networks
Wireless Metropolitan Area NetworksWireless Metropolitan Area Networks
Wireless Metropolitan Area Networks
 
3 g 4g adv_chal 041406 ver1
3 g 4g adv_chal 041406 ver13 g 4g adv_chal 041406 ver1
3 g 4g adv_chal 041406 ver1
 
Wifi Vs Wimax By Dr Walter Green
Wifi Vs Wimax By Dr Walter GreenWifi Vs Wimax By Dr Walter Green
Wifi Vs Wimax By Dr Walter Green
 
Full gsm overview (modified)
Full gsm overview  (modified)Full gsm overview  (modified)
Full gsm overview (modified)
 
Part 1 fundamentals of 3 g
Part 1  fundamentals of 3 gPart 1  fundamentals of 3 g
Part 1 fundamentals of 3 g
 
ATM
ATMATM
ATM
 
Aa
AaAa
Aa
 
LTE @ Yogyakarta, 19 December 2001
LTE @ Yogyakarta, 19 December 2001LTE @ Yogyakarta, 19 December 2001
LTE @ Yogyakarta, 19 December 2001
 

More from Abdulqader Al-kaboudei

More from Abdulqader Al-kaboudei (7)

Blue planet-essentials-nfv-and-sdn-guide
Blue planet-essentials-nfv-and-sdn-guideBlue planet-essentials-nfv-and-sdn-guide
Blue planet-essentials-nfv-and-sdn-guide
 
443029825 cloud-computing-week8-9-pptx
443029825 cloud-computing-week8-9-pptx443029825 cloud-computing-week8-9-pptx
443029825 cloud-computing-week8-9-pptx
 
Lte key technologies
Lte key technologiesLte key technologies
Lte key technologies
 
How to dimension user traffic in 4 g networks
How to dimension user traffic in 4 g networksHow to dimension user traffic in 4 g networks
How to dimension user traffic in 4 g networks
 
BICSI Wireless DAS Update
BICSI Wireless DAS UpdateBICSI Wireless DAS Update
BICSI Wireless DAS Update
 
Hsdpa principles
Hsdpa principlesHsdpa principles
Hsdpa principles
 
Rf planning umts with atoll1
Rf planning umts with atoll1Rf planning umts with atoll1
Rf planning umts with atoll1
 

Recently uploaded

Presentation on Engagement in Book Clubs
Presentation on Engagement in Book ClubsPresentation on Engagement in Book Clubs
Presentation on Engagement in Book Clubssamaasim06
 
BDSM⚡Call Girls in Sector 93 Noida Escorts >༒8448380779 Escort Service
BDSM⚡Call Girls in Sector 93 Noida Escorts >༒8448380779 Escort ServiceBDSM⚡Call Girls in Sector 93 Noida Escorts >༒8448380779 Escort Service
BDSM⚡Call Girls in Sector 93 Noida Escorts >༒8448380779 Escort ServiceDelhi Call girls
 
BDSM⚡Call Girls in Sector 97 Noida Escorts >༒8448380779 Escort Service
BDSM⚡Call Girls in Sector 97 Noida Escorts >༒8448380779 Escort ServiceBDSM⚡Call Girls in Sector 97 Noida Escorts >༒8448380779 Escort Service
BDSM⚡Call Girls in Sector 97 Noida Escorts >༒8448380779 Escort ServiceDelhi Call girls
 
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night Enjoy
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night EnjoyCall Girl Number in Khar Mumbai📲 9892124323 💞 Full Night Enjoy
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night EnjoyPooja Nehwal
 
Dreaming Marissa Sánchez Music Video Treatment
Dreaming Marissa Sánchez Music Video TreatmentDreaming Marissa Sánchez Music Video Treatment
Dreaming Marissa Sánchez Music Video Treatmentnswingard
 
My Presentation "In Your Hands" by Halle Bailey
My Presentation "In Your Hands" by Halle BaileyMy Presentation "In Your Hands" by Halle Bailey
My Presentation "In Your Hands" by Halle Baileyhlharris
 
Dreaming Music Video Treatment _ Project & Portfolio III
Dreaming Music Video Treatment _ Project & Portfolio IIIDreaming Music Video Treatment _ Project & Portfolio III
Dreaming Music Video Treatment _ Project & Portfolio IIINhPhngng3
 
AWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdf
AWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdfAWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdf
AWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdfSkillCertProExams
 
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptx
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptxChiulli_Aurora_Oman_Raffaele_Beowulf.pptx
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptxraffaeleoman
 
SaaStr Workshop Wednesday w/ Lucas Price, Yardstick
SaaStr Workshop Wednesday w/ Lucas Price, YardstickSaaStr Workshop Wednesday w/ Lucas Price, Yardstick
SaaStr Workshop Wednesday w/ Lucas Price, Yardsticksaastr
 
Causes of poverty in France presentation.pptx
Causes of poverty in France presentation.pptxCauses of poverty in France presentation.pptx
Causes of poverty in France presentation.pptxCamilleBoulbin1
 
lONG QUESTION ANSWER PAKISTAN STUDIES10.
lONG QUESTION ANSWER PAKISTAN STUDIES10.lONG QUESTION ANSWER PAKISTAN STUDIES10.
lONG QUESTION ANSWER PAKISTAN STUDIES10.lodhisaajjda
 
Report Writing Webinar Training
Report Writing Webinar TrainingReport Writing Webinar Training
Report Writing Webinar TrainingKylaCullinane
 
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...Hasting Chen
 
If this Giant Must Walk: A Manifesto for a New Nigeria
If this Giant Must Walk: A Manifesto for a New NigeriaIf this Giant Must Walk: A Manifesto for a New Nigeria
If this Giant Must Walk: A Manifesto for a New NigeriaKayode Fayemi
 
ANCHORING SCRIPT FOR A CULTURAL EVENT.docx
ANCHORING SCRIPT FOR A CULTURAL EVENT.docxANCHORING SCRIPT FOR A CULTURAL EVENT.docx
ANCHORING SCRIPT FOR A CULTURAL EVENT.docxNikitaBankoti2
 
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...Sheetaleventcompany
 
Uncommon Grace The Autobiography of Isaac Folorunso
Uncommon Grace The Autobiography of Isaac FolorunsoUncommon Grace The Autobiography of Isaac Folorunso
Uncommon Grace The Autobiography of Isaac FolorunsoKayode Fayemi
 
The workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdf
The workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdfThe workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdf
The workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdfSenaatti-kiinteistöt
 
Busty Desi⚡Call Girls in Sector 51 Noida Escorts >༒8448380779 Escort Service-...
Busty Desi⚡Call Girls in Sector 51 Noida Escorts >༒8448380779 Escort Service-...Busty Desi⚡Call Girls in Sector 51 Noida Escorts >༒8448380779 Escort Service-...
Busty Desi⚡Call Girls in Sector 51 Noida Escorts >༒8448380779 Escort Service-...Delhi Call girls
 

Recently uploaded (20)

Presentation on Engagement in Book Clubs
Presentation on Engagement in Book ClubsPresentation on Engagement in Book Clubs
Presentation on Engagement in Book Clubs
 
BDSM⚡Call Girls in Sector 93 Noida Escorts >༒8448380779 Escort Service
BDSM⚡Call Girls in Sector 93 Noida Escorts >༒8448380779 Escort ServiceBDSM⚡Call Girls in Sector 93 Noida Escorts >༒8448380779 Escort Service
BDSM⚡Call Girls in Sector 93 Noida Escorts >༒8448380779 Escort Service
 
BDSM⚡Call Girls in Sector 97 Noida Escorts >༒8448380779 Escort Service
BDSM⚡Call Girls in Sector 97 Noida Escorts >༒8448380779 Escort ServiceBDSM⚡Call Girls in Sector 97 Noida Escorts >༒8448380779 Escort Service
BDSM⚡Call Girls in Sector 97 Noida Escorts >༒8448380779 Escort Service
 
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night Enjoy
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night EnjoyCall Girl Number in Khar Mumbai📲 9892124323 💞 Full Night Enjoy
Call Girl Number in Khar Mumbai📲 9892124323 💞 Full Night Enjoy
 
Dreaming Marissa Sánchez Music Video Treatment
Dreaming Marissa Sánchez Music Video TreatmentDreaming Marissa Sánchez Music Video Treatment
Dreaming Marissa Sánchez Music Video Treatment
 
My Presentation "In Your Hands" by Halle Bailey
My Presentation "In Your Hands" by Halle BaileyMy Presentation "In Your Hands" by Halle Bailey
My Presentation "In Your Hands" by Halle Bailey
 
Dreaming Music Video Treatment _ Project & Portfolio III
Dreaming Music Video Treatment _ Project & Portfolio IIIDreaming Music Video Treatment _ Project & Portfolio III
Dreaming Music Video Treatment _ Project & Portfolio III
 
AWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdf
AWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdfAWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdf
AWS Data Engineer Associate (DEA-C01) Exam Dumps 2024.pdf
 
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptx
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptxChiulli_Aurora_Oman_Raffaele_Beowulf.pptx
Chiulli_Aurora_Oman_Raffaele_Beowulf.pptx
 
SaaStr Workshop Wednesday w/ Lucas Price, Yardstick
SaaStr Workshop Wednesday w/ Lucas Price, YardstickSaaStr Workshop Wednesday w/ Lucas Price, Yardstick
SaaStr Workshop Wednesday w/ Lucas Price, Yardstick
 
Causes of poverty in France presentation.pptx
Causes of poverty in France presentation.pptxCauses of poverty in France presentation.pptx
Causes of poverty in France presentation.pptx
 
lONG QUESTION ANSWER PAKISTAN STUDIES10.
lONG QUESTION ANSWER PAKISTAN STUDIES10.lONG QUESTION ANSWER PAKISTAN STUDIES10.
lONG QUESTION ANSWER PAKISTAN STUDIES10.
 
Report Writing Webinar Training
Report Writing Webinar TrainingReport Writing Webinar Training
Report Writing Webinar Training
 
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...
Re-membering the Bard: Revisiting The Compleat Wrks of Wllm Shkspr (Abridged)...
 
If this Giant Must Walk: A Manifesto for a New Nigeria
If this Giant Must Walk: A Manifesto for a New NigeriaIf this Giant Must Walk: A Manifesto for a New Nigeria
If this Giant Must Walk: A Manifesto for a New Nigeria
 
ANCHORING SCRIPT FOR A CULTURAL EVENT.docx
ANCHORING SCRIPT FOR A CULTURAL EVENT.docxANCHORING SCRIPT FOR A CULTURAL EVENT.docx
ANCHORING SCRIPT FOR A CULTURAL EVENT.docx
 
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...
No Advance 8868886958 Chandigarh Call Girls , Indian Call Girls For Full Nigh...
 
Uncommon Grace The Autobiography of Isaac Folorunso
Uncommon Grace The Autobiography of Isaac FolorunsoUncommon Grace The Autobiography of Isaac Folorunso
Uncommon Grace The Autobiography of Isaac Folorunso
 
The workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdf
The workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdfThe workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdf
The workplace ecosystem of the future 24.4.2024 Fabritius_share ii.pdf
 
Busty Desi⚡Call Girls in Sector 51 Noida Escorts >༒8448380779 Escort Service-...
Busty Desi⚡Call Girls in Sector 51 Noida Escorts >༒8448380779 Escort Service-...Busty Desi⚡Call Girls in Sector 51 Noida Escorts >༒8448380779 Escort Service-...
Busty Desi⚡Call Girls in Sector 51 Noida Escorts >༒8448380779 Escort Service-...
 

UMTS OVERVIEW

  • 1. UMTS ... … 3G Technology and Concepts
  • 2. GSM/GPRS network architecture GSM/GPRS core networkRadio access network BSS database IP Backbone Internet PSTN,ISDN BTSBTS BTSBTS BSCBSC MSCMSC VLRVLR SGSNSGSN GMSCGMSC HLRHLR AuCAuC EIREIR GGSNGGSN MSMS PCUPCU
  • 3. 3GPP Rel.’99 network architecture Core network (GSM/GPRS- based) Radio access network UTRAN UEUE Iu CS Iur Iub Uu Gn Iu PS database IP Backbone Internet PSTN BSBS BSBS RNCRNC RNCRNC MSCMSC VLRVLR SGSNSGSN GMSCGMSC HLRHLR AuCAuC EIREIR GGSNGGSN Iub
  • 4. 3GPP Rel.’99 network architecture Radio access network UTRAN UEUE Iur Iub Uu BSBS BSBS RNCRNC RNCRNC Iub 2G => 3G MS => UE (User Equipment), often also called (user) terminal New air (radio) interface based on WCDMA access technology New RAN architecture (Iur interface is available for soft handover, BSC => RNC)
  • 5. 3GPP Rel.’99 network architecture Core network (GSM/GPRS- based) Iu CS Gn Iu PS IP Backbone Internet PSTN MSCMSC VLRVLR SGSNSGSN GMSCGMSC HLRHLR AuCAuC EIREIR GGSNGGSN Changes in the core network: MSC is upgraded to 3G MSC SGSN is upgraded to 3G SGSN GMSC and GGSN remain the same AuC is upgraded (more security features in 3G)
  • 6. 3GPP Rel.4 network architecture Circuit Switched (CS) core network UTRAN (UMTS Terrestrial Radio Access Network) PSTN MSC Server MSC Server New option in Rel.4: GERAN (GSM and EDGE Radio Access Network) PS core as in Rel.’99 GMSC Server GMSC Server SGWSGW MGWMGW SGWSGW MGWMGW
  • 7. 3GPP Rel.4 network architecture Circuit Switched (CS) core network PSTN MSC Server MSC Server PS core as in Rel.’99 GMSC Server GMSC Server SGWSGW MGWMGW SGWSGW MGWMGW MSC Server takes care of call control signalling The user connections are set up via MGW (Media GateWay) “Lower layer” protocol conversion in SGW (Signalling GateWay) RANAP / ISUPRANAP / ISUP SS7 MTP SS7 MTP IP Sigtran IP Sigtran
  • 8. 3GPP Rel.5 network architecture CS core PSTN SGSNSGSN GGSNGGSN MGWMGW Internet HSSHSS IMS (IP Multimedia System) IMS (IP Multimedia System) PS core UTRAN (UMTS Terrestrial Radio Access Network) GERAN (GSM and EDGE Radio Access Network) New core network part:
  • 9. 3GPP Rel.5 network architecture CS core PSTN SGSNSGSN GGSNGGSN Internet/otherIMS HSSHSS PS core The IMS can establish multimedia sessions (using IP transport) via PS core between UE and Internet (or another IMS) Call/session control using SIP (Session Initiating Protocol) Interworking with the PSTN may be required for some time ... IMS (IP Multimedia System) IMS (IP Multimedia System) MGWMGW
  • 10. UMTS bearer service architecture TE MT UTRAN CN Iu edge node TECN gateway End-to-end service UMTS bearer service Radio access bearer service CN b.s. Local b.s. Ext. b.s. Radio b.s. Iu b.s. Backbone Radio Access BearerRadio Access BearerRadio BearerRadio Bearer UE Core network
  • 11. What is a bearer? Bearer: a bearer capability of defined capacity, delay and bit error rate, etc. (as defined in 3GPP specs.) Bearer is a flexible concept designating some kind of ”bit pipe” • at a certain network level (see previous slide) • between certain network entities • with certain QoS attributes, capacity, and traffic flow characteristics Four UMTS QoS Classes • conversational, streaming, interactive, background
  • 12. UMTS QoS (service) classes ConversationalConversational StreamingStreaming InteractiveInteractive BackgroundBackground low delay low delay variation video telephony/ conferencing speech video streaming audio streaming low round-trip delay www applications delay is not critical store-and- forward applications (e-mail, SMS) file transfer reasonably low delay basic applications basic QoS requirements
  • 13. Four UMTS QoS (service) classes ConversationalConversational StreamingStreaming InteractiveInteractive BackgroundBackground • speech (using AMR = Adaptive Multi-Rate speech coding) • video telephony / conferencing: ITU-T Rec. H.324 (over circuit switched connections) ITU-T Rec. H.323 or IETF SIP (over packet switched connections) • low delay (< 400 ms) and low delay variation • BER requirements not so stringent • in the radio network => real-time (RT) connections
  • 14. Adaptive Multi-Rate coding kbit/s 12.2 (= GSM EFR) 10.2 7.95 7.40 (= US TDMA) 6.70 (= PDC EFR) 5.90 5.15 4.75 Adaptive <=> During the call, the AMR bit rate can be changed, using the values at the right EFR = Enhanced Full RateCodec negotiation between transcoders <=>
  • 15. Transcoding UEUE MSCMSC GMSCGMSC User BUser B TCTC Transcoder (AMR/PCM) should be located as far as possible to the right (transmission capacity savings) TCTC Transcoding should be avoided altogether (better signal quality) TFO = Tandem Free Operation (2G) TrFO = Transcoder Free Operation (3G) (possible only if same coding is used at both ends of connection) (e.g. in PSTN)
  • 16. Four UMTS QoS (service) classes ConversationalConversational StreamingStreaming InteractiveInteractive BackgroundBackground • video streaming • audio streaming • reasonably low delay and delay variation • BER requirements quite stringent • traffic management important (variable bit rate) • in the radio network => real-time (RT) connections UEUE SourceSource video or audio information is buffered in the UE, large delay => buffer is running out of content! Buffer
  • 17. Four UMTS QoS (service) classes ConversationalConversational StreamingStreaming InteractiveInteractive BackgroundBackground • web browsing • interactive games • location-based services (LCS) • low round-trip delay (< seconds) • delay variation is not important • BER requirements stringent • in the radio network => non-real-time (NRT) connections
  • 18. Four UMTS QoS (service) classes ConversationalConversational StreamingStreaming InteractiveInteractive BackgroundBackground • SMS (Short Message Service) and other more advanced messaging services (EMS, MMS) • e-mail notification, e-mail download • file transfer • delay / delay variation is not an important issue • BER requirements stringent • in the radio network => non-real-time (NRT) connections
  • 19. UMTS protocols Different protocol stacks for user and control plane User plane (for transport of user data): Circuit switched domain: data within ”bit pipes” Packet switched domain: protocols for implementing various QoS or traffic engineering mechanisms Control plane (for signalling): Circuit switched domain: SS7 based (in core network) Packet switched domain: IP based (in core network) Radio access network: UTRAN protocols
  • 20. Data streamsData streams RLCRLC MACMAC Phys.Phys. UE UTRAN 3G MSC GMSC Uu Iu Gn User plane protocol stacks (CS domain) RLCRLC MACMAC Phys.Phys. WCDMAWCDMA TDMTDM Frame Protocol (FP)Frame Protocol (FP) AAL2AAL2 ATMATM Phys.Phys. AAL2AAL2 ATMATM Phys.Phys. TDMTDM
  • 21. User plane protocol stacks (PS domain) PDCPPDCP RLCRLC GTPGTP UDPUDP IPIP GTPGTP UDPUDP IPIP IPIP IPIP GTPGTP UDPUDP PDCPPDCP RLCRLC MACMAC Phys.Phys. MACMAC Phys.Phys. AAL5AAL5 ATMATM Phys.Phys. AAL5AAL5 ATMATM Phys.Phys. IPIP L2L2 L1L1 GTPGTP UDPUDP IPIP L2L2 L1L1 UE UTRAN SGSN GGSN Uu Iu Gn WCDMAWCDMA
  • 22. Uu (air, radio) interface protocols PHYPHY MACMAC RLCRLC RRCRRC Signalling radio bearers (User plane) radio bearers e.g. MM, CC, SM transparent to UTRAN Logical channels Transport channels PDCPPDCP L3 L2 L1
  • 23. Main tasks of Uu interface protocols MAC (Medium Access Control): • Mapping between logical and transport channels • Segmentation of data into transport blocks RLC (Radio Link Control): • Segmentation and reassembly • Link control (flow & error control) • RLC is often a transparent layer PDCP (Packet Data Convergence Protocol): • IP packet header compression (user plane only)
  • 24. Main tasks of RRC protocol Over the air interface, Radio Resource Control (RRC) messages carry all the relevant information required for setting up a Signalling Radio Bearer (during the lifetime of the RRC Connection) and setting up, modifying, and releasing Radio Bearers between UE and UTRAN (all being part of the RRC Connection). RRC also participates in the co-ordination of other Radio Resource Management (RRM) operations, such as measurements and handovers. In addition, RRC messages may carry in their payload higher layer signalling information (MM, CC or SM) that is not related to the air interface or UTRAN.
  • 25. General protocol model for UTRAN Radio Network Layer Transport Network Layer Control Plane User Plane Transport Netw. Control Plane Application Protocol Application Protocol Data Stream(s) Data Stream(s) Signalling Bearer(s) Signalling Bearer(s) ProtocolProtocol Data Bearer(s) Data Bearer(s) Transport Netw. User Plane Transport Netw. User Plane Signalling Bearer(s) Signalling Bearer(s) Physical LayerPhysical Layer
  • 26. Control Plane (Iub, Iur and Iu interfaces) Radio Network Layer: application protocols (NBAP, RNSAP and RANAP) are used for the actual signalling between base stations, RNC and core network. Transport Network Layer: signalling bearer for the transport of application protocol messages is set up by O&M actions (i.e. on a permanent basis). Transport Network Control Plane A signalling bearer (set up by O&M actions) carries a protocol which is used only for the task of setting up data bearers (e.g. AAL 2 connections).
  • 27. User Plane (Iub, Iur and Iu interfaces) The User Plane is employed for transport of • user information (speech, video, IP packets ...) • RRC signalling messages (Iub, Iur) • higher-layer protocol information at Iu interface (if not carried by RANAP). User plane data is carried by data bearers which use AAL 5 in case of Iu PS and AAL 2 in all other cases. User data streams are packed in frame protocols (FP) which are used for framing, error & flow control, and carrying of parallel data flows that form the user data signal (e.g. AMR encoded speech).
  • 28. Protocol structure at Iub interface Radio Network Layer Transport Network Layer Control Plane Transport Netw. Control Plane NBAPNBAP Transport Netw. User Plane Transport Netw. User Plane Q.2630.1Q.2630.1 Convergence Protocols Convergence Protocols AAL 5AAL 5 Conv. Pr.Conv. Pr. AAL 5AAL 5 AAL 2AAL 2 ATMATM Physical LayerPhysical Layer RRCRRC DataData RLCRLC MACMAC Frame ProtocolFrame Protocol
  • 29. Control Plane Transport Netw. Control Plane RNSAPRNSAP Transport Netw. User Plane Transport Netw. User Plane Q.2630.1Q.2630.1 Convergence Protocols Convergence Protocols AAL 5AAL 5 Conv. Pr.Conv. Pr. AAL 5AAL 5 AAL 2AAL 2 ATMATM Physical LayerPhysical Layer Protocol structure at Iur interface Radio Network Layer Transport Network Layer RRCRRC DataData RLCRLC MACMAC Frame ProtocolFrame Protocol
  • 30. Radio Network Layer Transport Network Layer Control Plane User Plane Transport Netw. Control Plane RANAPRANAP Transport Netw. User Plane Transport Netw. User Plane Q.2630.1Q.2630.1 Convergence Protocols Convergence Protocols AAL 5AAL 5 Conv. Pr.Conv. Pr. AAL 5AAL 5 CS ChannelCS Channel Iu UPIu UP AAL 2AAL 2 ATMATM Physical LayerPhysical Layer Protocol structure at Iu CS interface
  • 31. Radio Network Layer Transport Network Layer Control Plane User Plane Transport Netw. Control Plane RANAPRANAP Transport Netw. User Plane Convergence Protocols Convergence Protocols AAL 5AAL 5 IP ApplicationIP Application Protocol structure at Iu PS interface GTPGTP UDPUDP IPIP AAL 5AAL 5 ATMATM Physical LayerPhysical Layer Iu UPIu UP
  • 32. Application protocols in UTRAN Iub interface (between RNC and base station) NBAP (Node B Application Part) Iur interface (between Serving RNC and Drift RNC) RNSAP (Radio Network Subsystem Application Part) - Link management for inter-RNC soft handover Iu interface (between RNC and core network) RANAP (Radio Access Network Application Part) - Radio Access Bearer (RAB) management - SRNS Relocation - Transfer of higher-level signalling messages
  • 33. Serving RNC and Drift RNC in UTRAN Core network Iu Iur Iub Iub DRNC SRNC UEUE BSBS BSBS RNCRNC RNCRNC Concept needed for: Soft handover between base stations belonging to different RNCs
  • 34. Serving RNS (SRNS) Relocation RNS = Radio Network Sub-system = RNC + all base stations controlled by this RNC SRNS Relocation means that the Serving RNC functionality is transferred from one RNC (the “old” SRNC) to another (the “new” SRNC, previously a DRNC) without changing the radio resources and without interrupting the user data flow. RANAP provides the signalling facilities over the two Iu interfaces involved (Iu interfaces to “old” and “new” SNRC) for performing SRNC Relocation in a co-ordinated manner.
  • 35. SRNS Relocation (cont.) Core network Iu Iur Iub Iub DRNC SRNC UEUE BSBS BSBS RNCRNC RNCRNC Iu SRNC SRNC provides: 1) connection to core network 2) macrodiversity combining point
  • 36. Soft handover concept Iu Iur Iub Iub DRNC SRNC UEUE BSBS BSBS RNCRNC RNCRNC Leg 1 Leg 3 Signal combining point is in SRNC (downlink: in UE) BSBS Leg 2 Legs 1 and 2: Iur interface is not needed Leg 3 is added: Iur interface is needed! Core network
  • 37. Micro- / macrodiversity combining Iu Iur Iub Iub DRNC SRNC UEUE BSBS BSBS RNCRNC RNCRNC Macrodiversity combining point in SRNC Core network Rake receiver Multipath propagation Microdiversity combining point in base station (uplink)
  • 38. Micro- / macrodiversity combining Microdiversity combining: multipath signal components are processed in Rake “fingers” and combined (= summed) using MRC (MRC = Maximum Ratio Combining) Macrodiversity combining: the same bit sequences (with different bit error positions) are combined at the SRNC (usually: selection combining). Hard handover: slow (a lot of signalling) Soft handover: fast selection in SRNC (uplink)
  • 39. Radio Access Bearer (RAB) establishment RAB assignment request RAB assignment complete RAB is configured to be used over existing Radio Link(s) (RANAP signaling) UE BS RNC (RRC signaling) Core network
  • 40. Signalling between UE and core network UEUE BSBS RNCRNC MSC or SGSN MSC or SGSN RRC RANAP NAS signalling messages (NAS = Non Access Stratum = “not related to UTRAN”) are sent transparently through UTRAN in the payload of RRC/RANAP protocol messages
  • 41. Security in UMTS GSM UMTS SIM authentication (PIN code) SIM authentication (PIN code) User authenticationUser authentication Ciphering (air interface)Ciphering (air interface) Signalling data integritySignalling data integrity IP security (e.g. IPSEC)IP security (e.g. IPSEC) User authenticationUser authentication Network authenticationNetwork authentication USIM authentication (PIN code) USIM authentication (PIN code) Ciphering (air interface)Ciphering (air interface) KASUMI algorithm (known) UMTS: larger key lengths than in GSM
  • 42. Security in digital networks: terminology Authentication: SIM authentication (PIN code) user authentication (GSM, UMTS, DECT, TETRA) network authentication (UMTS, TETRA) Integrity: signalling data integrity (UMTS) Confidentiality (≈ privacy): ciphering of signals over radio interface hiding of user identifiers over radio interface end-to-end encryption (offered by service provider)
  • 43. Authentication Authentication: Procedure of verifying the authenticity of an entity (user, terminal, network, network element). In other words, is the entity the one it claims to be? SIM authentication is local (network is not involved) In GSM, only user is authenticated In UMTS, both user and network are authenticated User/network is authenticated at the beginning of each user-network transaction (e.g. location updating or connection set-up) and always before ciphering starts. See Security in GSM for more details
  • 44. Integrity Data integrity: The property that data has not been altered in an unauthorised manner. “Man-in-the-middle” security attack, e.g. false BS Data integrity checking is not done in GSM In UMTS, signalling messages are appended with a 32 bit security field (MAC-I) at the terminal or RNC before transmission and checked at the receiving end In UMTS, also volume of user data (not the user data itself) is integrity protected
  • 45. Signalling integrity protection in UMTS Signalling messageSignalling message Algorithm f 9 MAC-IMAC-I Integrity Key (IK) and other keys/parameters UEUE RNCRNC MAC-I generation MAC-I checking MAC-I generationMAC-I checking Both in terminal and RNC
  • 46. Confidentiality Confidentiality: The property that information is not made available to unauthorised individuals, entities or processes. Example 1: Ciphering (encryption) over the air interface Example 2: Preventing unencrypted transmission of user ID information such as IMSI number over the air interface => Temporary Mobile Subscriber Identity (TMSI) is generated (at the end of each MM or CM transaction) and is used at the beginning of the next transaction instead of IMSI.
  • 47. Example 1: ciphering (encryption) BSBS MSMS UEUE BTSBTS BSCBSC RNCRNC SGSNSGSN Core NetworkCore Network Air interface GPRS UMTS MSMS BTSBTS BSCBSC Core NetworkCore Network GSM Both CS and PS information Signalling integrity protection
  • 48. Network domain security Circuit switched network => quite good IP-based network (Internet) => rather poor at present (security mechanisms are developed by IETF, 3GPP...) Some security threats in IP-based network: Sniffing (electronic eavesdropping) Spoofing, session hijacking Denial of service (DoS), ”spamming” Confidentiality Integrity
  • 49. WCDMA Technology … just some basic issues
  • 50. RLCRLC RLCRLC Logical / Transport / Physical channels MACMAC FPFP PhyPhy FPFP UE Base station RNC AAL 2AAL 2 MACMAC AAL 2AAL 2 PhyPhy Logical channels Physical channels Transport channels : : WCDMA ::
  • 51. Logical / Transport channels CCCHCCCH DCCHDCCH PCHPCH DCHDCHDSCHDSCHFACHFACHBCHBCHDCHDCHCPCHCPCHRACHRACH DCCHDCCHCTCHCTCHCCCHCCCHBCCHBCCHPCCHPCCH Uplink Downlink DTCHDTCH DTCHDTCH Logical channels Transport channels
  • 52. Transport / Physical channels PCHPCH DCHDCHDSCHDSCHFACHFACH BCHBCH DCHDCH CPCHCPCHRACHRACH PRACHPRACH PCPCHPCPCH SCCPCHSCCPCH PCCPCHPCCPCH DPDCHDPDCH DPCCHDPCCH SCHSCHCPICHCPICH AICHAICH PICHPICH CSICHCSICH Physical channels Transport channels DPCHDPCH CD/CA- ICH CD/CA- ICH Uplink Downlink PDSCHPDSCH
  • 53. Physical channels in WCDMA Bit sequences from different physical channels are multiplied with a channelization code (spreading) multiplied with a scrambling code (scrambling) multiplexed in code domain modulated using QPSK. Downlink channels: conventional QPSK modulation DPCH = Dedicated physical channel Uplink channels: Dual-channel QPSK moduation DPDCH = Dedicated physical data channel DPCCH = Dedicated physical control channel
  • 54. DPCH structure in downlink TFCITFCI DataData TPCTPC DataData 10 ms radio frame 0 1 2 14 2560 chips PilotPilot QPSK modulation, time multiplexed data and control information: (DPCH = Dedicated Physical Channel)
  • 55. DPDCH / DPCCH structure in uplink (Dedicated Physical Data/Control Channel) DataData PilotPilot TFCITFCI FBIFBI TPCTPC DPDCH (I-branch)DPDCH (I-branch) 10 ms radio frame (38400 chips) 0 1 2 14 2560 chips DPCCH (Q-branch)DPCCH (Q-branch) Dual-channel QPSK modulation:
  • 56. Spreading in WCDMA Channel data Channel data Channelization code Channelization code Scrambling code Scrambling code Channel bit rate Chip rate Chip rate Usage of codeUsage of code UplinkUplink DownlinkDownlink Channelization code Scrambling code User separation User separation Cell separation (always 3.84 million chips/s)
  • 57. Spreading in WCDMA Chip rate = SF x channel bit rateChip rate = SF x channel bit rate Chip rate after spreading = 3.84 Mchips/sChip rate after spreading = 3.84 Mchips/s Uplink: DPCCH SF = 256, DPDCH SF = 4 - 256Uplink: DPCCH SF = 256, DPDCH SF = 4 - 256 Downlink: DPCH SF = 4 - 256 (512)Downlink: DPCH SF = 4 - 256 (512) Spreading factor (SF) is important in WCDMA One bit consists of 256 chips One bit consists of 4 chips
  • 58. Uplink DPDCH bit rates 256 128 64 32 16 8 4 SF Channel bit rate (kb/s) User data rate (kb/s) 15 30 60 120 240 480 approx. 7.5 approx. 15 approx. 30 approx. 60 approx. 120 approx. 240 960 approx. 480
  • 59. Downlink DPDCH bit rates 256 128 64 32 16 8 4 SF Channel bit rate (kb/s) User data rate (kb/s) 15 30 60 120 240 480 approx. 1-3 approx. 6-12 approx. 20-24 approx. 45 approx. 105 approx. 215 960 approx. 456 512 1920 approx. 936
  • 60. User data rate vs. channel bit rate Channel bit rate (kb/s)Channel bit rate (kb/s) User data rate (kb/s)User data rate (kb/s) Channel codingChannel coding InterleavingInterleaving Bit rate matchingBit rate matching Interesting for user Interesting for user Important for system Important for system
  • 61. Services for 3G (and partly 2G) • terminology • basic concepts
  • 62. New service concept End userEnd user End userEnd user Carrier providerCarrier provider Service providerService provider Service providerService provider Content providerContent provider Content providerContent provider all want to make profit
  • 63. OSA is being standardised, so that services provided by different service/content providers can be created and seamlessly integrated into the 3G network (this is the meaning of “open” architecture) OSA (Open Services Architecture/Access) 3G network API API API Service Creation Environment (SCE) API = Application Programming Interface (Standardised) OSA means in practice:
  • 64. CAMEL (Customised Applications for Mobile network Enhanced Logic) is a set of “IN” type functions and procedures that make operator-specific IN services available to subscribers who roam outside their home network. CAMEL = IN technology + global mobility CAMEL Service Environment (CSE) is a logical entity in the subscriber’s home network which processes IN related procedures CSE ≈ SCP in home network CAMEL (2G & 3G)
  • 65. Circuit switched call-related IN procedures CAMEL Phase 1 1. Call control proceeds up to MSC SSPSSP MSCMSC SCP in home network (CSE) SCP in home network (CSE) 1. 2. 3. 4. 5. 2. Trigger activated in basic call state model at SSP 3. SSP requests information from CSE 4. CSE provides information 5. Call control continues Typical triggers: Calling number Called number Cell ID Protocol: CAP instead of MAP
  • 66. CAMEL Phase 2 Non-call-related procedures possible 1. Call control proceeds as normal 2. Call control is interrupted 3. Call control resumes Typical application: In prepaid service: announcement ”your prepaid account is approaching zero” (e.g. for announcement) IN functionality is extended to include packet switched sessions... CAMEL Phase 3
  • 67. Virtual Home Environment (VHE) Same subscriber profile & charging/numbering information can be utilised in any UMTS network Home PLMN Visited PLMN UEUE Certain subscriber profile Same subscriber profile
  • 68. Supporting technologies and services PositioningPositioning SMSSMS USSDUSSD MMSMMSLCSLCS SATSAT USATUSAT MExEMExE WAPWAP Location UE Transport & Contenti-Modei-Mode - many are already possible in 2G - will (perhaps) be extensively used in 3G
  • 69. Location (based) services (LCS) - may or may not use UE positioning techniques - general LCS architecture in UMTS: UEUE PSTN Internet BSBS LMULMU RNC & SMLC RNC & SMLC MSCMSC GMLCGMLC SGSNSGSN GGSNGGSN HLR/AuC/EIRHLR/AuC/EIR GMSCGMSC LCS External Client
  • 70. Location (based) services (cont.) GMLC = Gateway Mobile Location Center receives service requests from external LCS clients (or UE) and manages the location information SMLC = Serving Mobile Location Center assists in positioning of the UE (e.g. performs calculations based on measurement results), is usually integrated with RNC LCS client = typically any server requesting location information (to be able to provide the relevant location service to the user), may also be the UE
  • 71. Positioning methods BSBS BSBS BSBS UEUE LMULMU Cell ID based location information - no expensive positioning solutions required - inexpensive (and will therefore be widely used) E-OTD (2G), OTDOA (3G) - differential delays measured from which the position is calculated (in SMLC) Assisted GPS - greatest precision, GPS receiver in UE - network must “assist” in indoor environment SMLCSMLC
  • 72. SAT (= USAT in 3G) SAT (SIM Application Toolkit) is a set of standardized functions for communication between SIM and ME SIM ME Applications (GSM 11.14): • profile download (ME tells SIM what it can do) • proactive SIM (display text from SIM to ME, send short message, transfer info from ME to SIM,...) • call control by SIM • data download from network to SIM Download (e.g. Java applets) from server in network will be important in UMTS Interaction between ME and SIM
  • 73. MExE Mobile Execution Environment (MExE) provides standardized application execution environments for UE, defined in classmarks: MExE Classmark 1 MExE Classmark 2 MExE Classmark 3 UE is WAP compatible (i.e. contains WAP browser) UE can execute PersonalJava applications (subset of J2SE) UE is J2ME compatible Standard Edition Micro Edition: see: www.mexeforum.org Evolution continues ...
  • 74. SMS vs. USSD SMS = Short Message Service USSD = Unstructured Supplementary Services Data SMS • 160 ASCII characters (max) • in all GSM terminals • store-and-forward service (=> delay) • transport of messages • SMS transaction always initiated by terminal USSD • 182 ASCII characters (max) • in all GSM terminals • connection oriented transactions (small delay) • transport of technical data • terminal or application in network initiates session very popular not much used (yet)
  • 75. MMS MMS = Multimedia Messaging System Offers the possibility to send messages to/from MMS capable handsets comprising a combination of - text - sounds - images - video GPRS or 3G packet domain can be used for transport. When combined with LCS information and IN (CAMEL) features, interesting new services can be implemented.
  • 76. WAP (Wireless Application Protocol) Transports WML (Wireless Markup Language) information between terminal and WAP Gateway (using its own set of protocols) WAP Gateway WAP Gateway UEUE 2G/3G networ k Internet Server Internet Server WAP browser WML / HTML translation WMLWML WAP protocolsWAP protocols 2G/3G transport2G/3G transport WML is a subset of XML e.g. WTP (similar functionality as HTTP) SMS, USSD, GPRS, 3G packet transport ... WML / HTML / XML content
  • 77. Service interaction example 3G subscriber is hungry and asks for a list of nearby located restaurants (from appropriate “Internet Server”). Network scenario: UEUE 2G/3G networ k WAP Gateway WAP Gateway Internet Server Internet Server CAMEL (CSE) CAMEL (CSE) GMLCGMLC MExEMExE See: Kaaranen et al: UMTS Networks
  • 78. Example, Step 1 By use of his/her WAP browser in the UE, user contacts (via WAP Gateway) the “Internet Server” containing relevant information. UEUE 2G/3G networ k WAP Gateway WAP Gateway Internet Server Internet Server CAMEL (CSE) CAMEL (CSE) GMLCGMLC MExEMExE WAP browser
  • 79. Example, Step 2 The 2G/3G network retrieves subscription information (e.g. state of “prepaid” account) from the user’s CSE (Camel Service Environment). Charging info UEUE 2G/3G networ k WAP Gateway WAP Gateway Internet Server Internet Server CAMEL (CSE) CAMEL (CSE) GMLCGMLC MExEMExE
  • 80. Example, Step 3 “Internet Server” acts as a “LCS client” and requests the 2G/3G network to investigate where the user is located. UEUE 2G/3G networ k WAP Gateway WAP Gateway Internet Server Internet Server CAMEL (CSE) CAMEL (CSE) GMLCGMLC MExEMExE Where is UE located?
  • 81. Example, Step 4 The “MExE compatible Internet Server” prepares the information according to the MExE capabilities of UE (in this case MExE Classmark 1: WAP). What can UE display? UEUE 2G/3G networ k WAP Gateway WAP Gateway Internet Server Internet Server CAMEL (CSE) CAMEL (CSE) GMLCGMLC MExEMExE ? ?
  • 82. Example, Step 5 Now the “local restaurants” information is downloaded to the user and displayed in the appropriate form. Restaurant 1 Restaurant 2 Restaurant 3 Restaurant 4 Menu on display: UEUE 2G/3G networ k WAP Gateway WAP Gateway Internet Server Internet Server CAMEL (CSE) CAMEL (CSE) GMLCGMLC MExEMExE
  • 83. Further information on 3G systems and services Links: see slides Books: Kaaranen et al., UMTS Networks: Architecture, Mobility and Services, Wiley, 2001, ISBN 0-471-48654-X Korhonen, Introduction to 3G Mobile Communications, Artech House, 2001, ISBN 1-58053-287-X Web material: e-learning course “Introduction to 3G” contains audio and flash animations (you need loudspeakers; access to course only within the HUT computer network) http://130.233.158.46/eopetus/intro3g/start.htm Required course material